Sony vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-18284 Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability.High 7.8 · Aug 20, 2026
• CVE-2026-18282 Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability.High 8 · Aug 20, 2026
• CVE-2026-18281 Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability.High 8 · Aug 20, 2026
• CVE-2026-18279 Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Aug 20, 2026
• CVE-2026-59776 Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017.High 7 · Jul 21, 2026
• CVE-2025-64390 A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02.High 7.4 · Jun 2, 2026
• CVE-2025-64772 The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.High 8.4 · Nov 30, 2025
• CVE-2025-62225 Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path.High 8.4 · Nov 5, 2025
• CVE-2025-5820 Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability.High 8.8 · Jun 20, 2025
• CVE-2025-5479 Sony XAV-AX8500 Bluetooth AVCTP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability.High 7.5 · Jun 20, 2025
• CVE-2025-5478 Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability.High 8.8 · Jun 20, 2025
• CVE-2025-5477 Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability.High 7.5 · Jun 20, 2025
• CVE-2025-5476 Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability.High 8.8 · Jun 20, 2025
• CVE-2025-5475 Sony XAV-AX8500 Bluetooth Packet Handling Integer Overflow Remote Code Execution Vulnerability.High 7.5 · Jun 20, 2025
• CVE-2025-5124 A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30.Critical 9.2 · May 24, 2025
• CVE-2024-23934 Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Sep 23, 2024
• CVE-2022-41796 Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan horsHigh 7.8 · Oct 24, 2022
• CVE-2022-23747 In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playbacCritical 9.8 · Aug 17, 2022
• CVE-2021-20793 Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allowsHigh 7.8 · Aug 25, 2021
• CVE-2020-5589 SONY Wireless Headphones WF-1000X, WF-SP700N, WH-1000XM2, WH-1000XM3, WH-CH700N, WH-H900N, WH-XB700, WH-XB900N, WI-1000X, WI-C600N and WI-SP600N with firmware vHigh 8.8 · Jun 9, 2020
• CVE-2019-19364 A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.High 7.8 · Dec 4, 2019
• CVE-2019-15416 The Sony keyaki_kddi Android device with a build fingerprint of Sony/keyaki_kddi/keyaki_kddi:7.1.1/TONE3-3.0.0-KDDI-170517-0326/1:user/dev-keys contains a pre-iHigh 7.8 · Nov 14, 2019
• CVE-2019-11890 Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired or Wi-Fi LAN.High 7.5 · Jul 9, 2019
• CVE-2019-11889 Sony BRAVIA Smart TV devices allow remote attackers to cause a denial of service (device hang) via a crafted web page over HbbTV.High 7.5 · Jul 9, 2019
• CVE-2019-5982 Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a malHigh 7.5 · Jul 5, 2019